CVE-2018-5392

Name	CVE-2018-5392
Description	mingw-w64 version 5.0.4 by default produces executables that opt in to ASLR, but are not compatible with ASLR. ASLR is an exploit mitigation technique used by modern Windows platforms. For ASLR to function, Windows executables must contain a relocations table. Despite containing the "Dynamic base" PE header, which indicates ASLR compatibility, Windows executables produced by mingw-w64 have the relocations table stripped from them by default. This means that executables produced by mingw-w64 are vulnerable to return-oriented programming (ROP) attacks. Windows executables generated by mingw-w64 claim to be ASLR compatible, but are not. Vulnerabilities in such executables are more easily exploitable as a result.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	968277

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mingw-w64 (PTS)	jessie	3.2.0-2	vulnerable
	stretch	5.0.1-1	vulnerable
	buster	6.0.0-3	vulnerable
	bullseye	8.0.0-1	vulnerable
	bookworm	10.0.0-3	vulnerable
	trixie, sid	11.0.1-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mingw-w64	source	(unstable)	(unfixed)	unimportant		968277

Notes

https://sourceforge.net/p/mingw-w64/mailman/message/31034877/
https://sourceware.org/bugzilla/show_bug.cgi?id=17321
https://sourceware.org/bugzilla/show_bug.cgi?id=19011
https://www.kb.cert.org/vuls/id/307144 (describes workaround)